From: Austin Ziegler <austin@...>
Date: 2003-09-20T23:52:39+09:00
Subject: Re: POP3Filter for SoBig.F Virus:

On Sat, 20 Sep 2003 22:15:40 +0900, Gavin Sinclair wrote:
> On Saturday, September 20, 2003, 9:03:18 PM, Shashank wrote:
>> Thank you very Austin and Gavin.
>>
>> I have been inundated with spam in the last few hours and this nice
>> little utility has helped me a lot.
>>
>> I have a question though: the size of email defaults to 120_000. Is
>> there some significance to this number or is it just an arbitrary
>> number you picked. I have been getting some spam with attachments which
>> are 106K or in that range. Of course, I have changed my version to
>> catch them too but was curious to find out.
> All of my virus-spam messages have been around 140Kb.  One exception was
> about 15Kb.

The Perl version I translated from -- and I just modified the WikiPage to 
include the historic influences -- had 150_000 as the size default. I 
figured it was a bit high, so I dropped it to 120_000. In one of my later 
changes to the tool, though, I moved it from a constant to the fourth 
parameter (defaulted) in the constructor.

>> Also, would it possible for you to add something like the "kill file"
>> support so that I can keep adding new patterns to it instead of
>> modifying the source code.
> No need really, and I don't have the time.  But you can go for it and
> change the Wiki code if you like.  Or if your version is significantly
> different then offer it as a separate implementation.

Actually, it's even easier than that. I just modified the last line so that 
it looks like:

  if __FILE__ == $0
    POP3Filter.new("server", "user", "pass").process
  end

Now, pop3filter is easy to include into a separate program. What you would 
do to use this is:

  require 'pop3filter.rb'

  POP3Filter.SUBJECT_RE << %r{enlarge}i
  POP3Filter.new("server", "user", "pass", 80_000).process

This will now look for subjects that have the word "enlarge" in them, and it 
will look for messages of 80,000 bytes.

The code could be abstracted a bit further -- so that we can (via 
meta-programming) tell it what headers we want and have multiple categories, 
but this is simply a quick hack to get rid of the current infestation. 
Another nice change would be to actually have a Tk (or other graphical) 
interface so that you could select which messages you want deleted without 
having to either (a) delete them all or (b) respond to each message 
interactively.

-austin
--
austin ziegler    * austin@halostatue.ca * Toronto, ON, Canada
software designer * pragmatic programmer * 2003.09.20
                                         * 10.42.42